Computer security using context triggered piecewise hashing
AssigneeMicrosoft Technology Licensing, LLC
InventorGang Zhou
Life of this patent
Estimating the term…
Abstract
Generally discussed herein are devices, systems, and methods for clustering based on context triggered piecewise hashing (CTPH). A method can include determining a first index of a first CTPH string of the file. The first index can include contiguous bits of the CTPH string. The first index can be smaller than the CTPH string, such as to be a proper subset of the CTPH string. The method can include determining the first index matches a second index of a cluster of files and in response to determining the first index matches the second index of the cluster, associating the file with the cluster. The method can include determining that the file includes malware based on the cluster.
Claims18
A system comprising:
- processing circuitry;
- and
- a memory including instructions stored thereon that, when executed by the processing circuitry, cause the processing circuitry to perform operations for determining a file type of a file, the operations including:
- splitting a first context triggered piecewise hashing (CTPH) string of the file into disjoint portions of contiguous bits;
- determining a first index of a first CTPH string of the file, the first index is a first number of contiguous bits of a portion of the portions of the CTPH string;
- determining the first index matches a second index of a cluster of files;
- in response to determining the first index matches the second index of the cluster, associating the file with the cluster;
- and
- determining the file type based on the cluster.
A processing circuitry-implemented method for determining a file type of a file, the method comprising:
- splitting a first context triggered piecewise hashing (CTPH) string of the file into disjoint portions of contiguous bits;
- determining a first index of a first CTPH string of the file, the first index is a first number of contiguous bits of a portion of the portions of the CTPH string;
- determining the first index matches a second index of a cluster of files;
- in response to determining the first index matches the second index of the cluster, associating the file with the cluster;
- and
- determining the file type based on the cluster.
A non-transitory machine-readable medium including instructions that, when executed by a machine, cause the machine to perform operations for determining a file type of a file, the operations comprising:
- splitting a first context triggered piecewise hashing (CTPH) string of the file into disjoint portions of contiguous bits;
- determining a first index of a first CTPH string of the file, the first index is a first number of contiguous bits of a portion of the portions of the CTPH string;
- determining the first index matches a second index of a cluster of files;
- in response to determining the first index matches the second index of the cluster, associating the file with the cluster;
- and
- determining the file type based on the cluster.
Dependencies are inferred from the claim text.